Token authentication timeout

Question

I'm seeing some behavior I don't understand with token timeouts. My code creates a token with a 60 minute, 100 login limit:
try
   ISessionMgr        sessionMgr        = CrystalEnterprise.getSessionMgr();
   IEnterpriseSession enterpriseSession = sessionMgr.logon(id, pwd, server, type);
   // Now create the login token
   ILogonTokenMgr logonTokenMgr = enterpriseSession.getLogonTokenMgr();
   token = logonTokenMgr.createWCAToken("", 60, 100);
catch(Exception e)
   throw new LoginHelperException(e);
I have a web front end that calls various services. All these services begin with an auth check that looks something like this:
try
   if(token == null)
      throw new LoginHelperException("Missing token");
   else
      enterpriseSession = CrystalEnterprise.getSessionMgr().logonWithToken(token);
I am not storing the enterpriseSession in my web session. I create a new one with the token for every request.  It's my understanding I should only have to create a new token after 60 minutes, or after 100 calls to logonWithToken(), which ever comes first. But what I'm seeing in practice is an auth exception after only a few minutes.
2008-11-14 09:41:39,457 ERROR [http-8080-Processor24] (report_jsp.java:120) - Exception in report.jsp
com.reporting.bo.exceptions.LoginHelperException: com.crystaldecisions.sdk.exception.SDKServerException: An error occurred at the server :
Session ID is not valid.
cause:com.crystaldecisions.enterprise.ocaframework.idl.OCA.oca_abuse: IDL:img.seagatesoftware.com/OCA/oca_abuse:3.2
detail:An error occurred at the server :
Session ID is not valid.
The server supplied the following details: OCA_Abuse exception 10503 at [exceptionmapper.cpp : 65]  42436 {}
        ...Session ID is not valid. Original session not available for ONEOFF logon
Am I misunderstanding how tokens work? I'd like for the token to be valid for more than 10 minutes.

Answer 1

You're using the WCA token.
Validity lifetime of a WCA token is tied to the originating EnterpriseSession that created it.
Since the originating EnterpriseSession is going out of scope in your code, it gets GC'ed.
When the CMS detects that the EnterpriseSession no longer exists, it invalidates all WCA tokens associated with it.
Next time you try to use the WCA token, it fails.
So either use the Logon Token - that uses a CAL each time you use it - or keep the EnterpriseSession live but make sure you log it off when you're done with it.
Sincerely,
Ted Ueda